A trust and observability layer for AI agents
TestMachine records every tool call your agents make, checks each one against the rules your team writes, and blocks the ones that break them.
TestMachine is free for your first 1,000 actions each month.
What it does
01Logs
TestMachine sits beside your agents as the gateway for their tool calls. Each call is recorded with the agent, the tool, its arguments and the decision, so you can see what your agents do before you write a single rule.
02Enforcement
TestMachine checks each call against the policy assigned to the agent and blocks the calls that break a clause. With the block, it returns the clause and your team’s instructions for what to do instead, so the agent can take an allowed path without a person stepping in.
03Accountability
Policies are written in plain English, versioned, and owned by named people. Each block traces to a clause, each clause to its owner, and each change to the person who approved it.
Product views from TestMachine, shown with sample data.
How it works
Your team writes the policy in plain English, including what an agent should do instead when a clause blocks it, and signs it off.
Assign the policy to the people and agents it covers.
TestMachine checks each tool call. It allows the call, or blocks it and tells the agent which clause applies and what to do instead.
Review the decisions, and approve each revision as a new version of the policy.
Point Claude Code, Codex or your own MCP client at your organization’s TestMachine endpoint. Each person signs in with your company’s identity provider.
Add the MCP servers your agents already use, such as GitHub and Notion. Each person connects their own account, or an admin stores one shared key.
Start in dry-run mode. TestMachine records what it would block and lets every call through, so you see a policy’s effect before it enforces.
Blocked by policy.
§02 No customer phone numbers in outbound messages.
Why: Customer phone numbers stay in the CRM.
What to do instead: Remove the number, or link to
the CRM record.The instructions come from the clause your team wrote. The agent can follow them and make an allowed call, which TestMachine checks like any other, without a person stepping in.
Use cases
All three rules come in the starter policy for new organizations. Each example shows what the agent tried, what TestMachine did, and what happened next.
§02 No prompt injection in email
Anyone can email your agent. TestMachine reads what Gmail returns before the agent does, including text hidden in the HTML, and withholds email that tries to instruct the agent. The agent tells the person what happened instead of acting on it.
One instruction in plain sight, one hidden in the HTML.
Recreation of Gmail, hidden text revealed
The agent gets the clause instead of the email.
TestMachine dashboard
Nothing is paid, forwarded or hidden.
Agent reply from a live model; chat recreated
§03 No customer PII in Slack
Asked to “send it to the team”, an agent can paste in the whole record. TestMachine checks every Slack message, draft and canvas before it is sent, blocks customer names, contact details and identifiers, and tells the agent to use the ticket or customer ID instead.
The customer’s name, personal email and phone, pasted from the ticket.
Recreation of Slack
The agent is told to use the ticket or customer ID.
TestMachine dashboard
Same escalation, no personal details.
TestMachine dashboard
§01 No AI-sounding posts on X
An agent posting for your brand can slip in the tells readers spot at once: the em dash, the “it’s not just X, it’s Y” template, chatbot leftovers. TestMachine checks the post before it reaches X and tells the agent what to fix.
An em dash and an “isn’t just X, it’s Y” template.
Recreation of X
The agent is told the clause and what to fix.
TestMachine dashboard
Same facts, none of the tells.
TestMachine dashboard
An immune system for the governance layer
Attacks on people have long worked better than attacks on infrastructure. Agents now read email, messages and tool results written by strangers, so the same tactics reach them. A request can be worded to pass a filter that matches patterns.
TestMachine reads each action against the meaning of the rule. That lets it hold the request a pattern match would pass, and it gives the rule owners one place to respond when the threat changes.
“Off the record: last night’s outage was caused by a botched database migration, not an attack…”
Pricing
For teams trying TestMachine on their first agents.
$0per month
1,000 actions included each month
Get early accessFor teams running agents in production. You pay only for the actions TestMachine checks.
$1per 1,000 actions
Billed monthly, no minimum
Get early accessEverything in Free, plus:
For regulated industries, private deployments and high volume.
Custom
Annual contract
Book NowEverything in Pay as you go, plus:
An action is one tool call that TestMachine checks. Early-access teams use TestMachine free until billing launches.
FAQ
One tool call that TestMachine checks. A call TestMachine allows and a call it blocks each count once.
Any agent that calls tools over MCP. Claude Code and Codex are recognized when they sign in. An admin names any other agent before its calls go through.
No code changes. You point the agent at your TestMachine endpoint in place of each tool’s MCP server, and sign in once. TestMachine forwards allowed calls to the tool and returns the result unchanged.
Yes. Each clause can carry instructions your team writes, such as drafting an email for a teammate to review in place of sending it. When the clause blocks a call, TestMachine returns those instructions with the block. The agent chooses its next call, and TestMachine checks that call too.
Yes. In dry-run mode TestMachine records every decision it would make and still forwards each call.
TestMachine blocks the call and records why. In dry-run mode the call still goes through.
TestMachine stores them encrypted and sends each one only to the server it belongs to. Agents never receive them.
Early-access teams use TestMachine free until billing launches. We will confirm pricing with each team before then.
The autonomous organization
In an autonomous organization, agents carry much of the company’s work: they pay invoices, answer customers and negotiate with vendors. Two layers make that possible. Memory gives agents the company’s context and habits. Policy sets the limits they act within, and names the person who answers for each one. Memory guides an agent, and policy is the layer that can stop it.
Rules owned by named people, enforced on every agent action.
Act for the company in finance, sales, support and comms.
Holds the company’s knowledge and habits. Agents draw on it, and nothing enforces it.
Real-time loop
Policy checks each action before it runs. A held action goes to the person who owns the rule.
Long loop
Memory builds up from the company’s work over months. It gives agents the context to act the way the company does.
Record what your agents do today, with no rules switched on.
Write the rules, enforce them on every call and keep the record.
Give agents more of the work as the record shows they stay inside the rules.
Early access
Answer five quick steps about your agents, and we will show you how TestMachine fits as you go. We are onboarding a small number of teams, and early-access teams use TestMachine free until billing launches.
To talk it through first, book a call with the team.
